OCI Networking VCN - Connections to Various OCI Resources are Failing when Routing Through an OCI Firewall such as a Palo Alto or Fortinet Instance (Doc ID 2850197.1)

Last updated on MAY 19, 2023

Applies to:

Symptoms

When accessing OCI Resources, such as the Load Balancer, the Oracle Service Network (for example, OKE targets), etc. fail when routed through a firewall cloud instance such as a Palo Alto, Checkpoint or Fortinet/Fortigate.  When bypassing the firewall and connecting directly to the resource, the connection is successful.

Symptoms can include hanging SSL connections, intermittent connectivity, or traffic working from certain subnets and not others - this can include traffic from on premises over one IPSEC/FastConnect tunnel, vs. another tunnel. 

In one case a packet capture at the Palo Alto shows the Server Hello not reaching the Palo Alto from the resource during the SSL/TLS handshake negotiation, resulting in a hanging connection to the load balancer.  This may also manifest itself in other traffic conversations where traffic is getting dropped at the firewall.  Yet, typical Path Maximum Transmission Unit Discovery (PMTUD) troubleshooting does not show a problem with packet fragmentation in the path.

The firewall logs do not show any drops.

Changes

Cause

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.